Hydra legacy target blacklist permits unsafe PyYAML loading
影響: pip:hydra-core >= 1.3.6, < 1.3.8 → 1.3.8, pip:hydra-core >= 1.4.0.dev9, < 1.4.0rc3 → 1.4.0rc3
Hydra's legacy target blacklist omits PyYAML's unsafe loading surfaces. If an application passes attacker-controlled targets and arguments to instantiate(), a target such as yaml.unsafe_load can execute Python code through a config-controlled YAML stream containing Python object-construction tags. Impact and prerequisites The attacker must control the relevant target and arguments that the application instantiates. The configured callable executes with the application's process privileges. This…
| 정보원 | GitHub Advisory Database |
|---|---|
| 수집 시각 | 2026. 10. 28. 오전 06:03 |
| 데이터 | Markdown JSON |
2026. 10. 28. 오전 02:08, GitHub Advisory Database에서 "Hydra legacy target blacklist permits unsafe PyYAML loading"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python.